ZoloBlocks vulnerabilities

The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_popup_status() function in all versions up to and including 2.3.11. This allows unauthenticated attackers to enable or disable popups.

The ZoloBlocks plugin up to version 2.3.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.

The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to and including 2.3.10 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.

Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery. This issue affects ZoloBlocks from n/a through <= 2.3.11.

The ZoloBlocks plugin contains a DOM-Based XSS vulnerability in versions up to and including 2.3.12. An attacker can exploit this to execute malicious scripts in the user's browser.